Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

Mozilla on Sept. 15 shipped a "highly critical" Firefox update to correct a range of security flaws that could lead to security bypass, cross-site scripting, spoofing, denial-of-service and system access attacks.

The open-source group patched a total of seven vulnerabilities in its flagship browser and warned that the majority of the flaws could be exploited to run attacker code without any user interaction beyond normal Web browsing.

Since releasing Firefox 1.5 in November 2005, Mozilla has patched 59 security vulnerabilities in the browser, more than half rated by the company as "critical."

The most serious bug fixed in the Firefox 1.0.7 update is an error in the handling of JavaScript. This can be exploited to cause a heap-based buffer overflow to execute arbitrary code without user action.

The browser refresh also fixes a crash that presents evidence of memory corruption, an auto-update compromise through DNS and SSL spoofing, and a signature forgery issue that allows malicious hackers to forge SSL certificates.

In addition, it fixes several time-dependent errors during text display that can be exploited to corrupt memory.

The company also shipped a new version of the Thunderbird mail client to provide patches for six security bugs that could cause man-in-the-middle attacks, security restrictions bypass and system compromise attacks.

Mozilla warned that scripts in remote XBL files in e-mails can be executed even when JavaScript has been disabled in Thunderbird. This can be exploited to cause JavaScript code to be executed whenever the HTML content of an e-mail is being viewed, forwarded or replied to.

A "highly critical" update was also issued for the Mozilla SeaMonkey suite to correct a range of spoofing, denial-of-service and system access vulnerabilities.

The updates come just weeks after Mozilla announced the hiring of former Microsoft security strategist Window Snyder as its new quality control czar. Snyder, who was responsible for security sign-off for Microsofts Windows XP Service Pack 2 and Windows Server 2003, will spearhead Mozillas security strategy.

/zimages/5/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.